* [PATCH] libxc: fix out of range shift in populate_acpi_pages
@ 2016-09-28 15:02 Wei Liu
2016-09-28 15:22 ` Boris Ostrovsky
0 siblings, 1 reply; 3+ messages in thread
From: Wei Liu @ 2016-09-28 15:02 UTC (permalink / raw)
To: Xen-devel; +Cc: Ian Jackson, Boris Ostrovsky, Wei Liu
"unsigned int" is only 4-byte long and "4" is treated as int. The shift
would overflow. Use "unsigned long" (to match the type of idx) and
"4UL" instead.
Caught by clang compilation test.
Signed-off-by: Wei Liu <wei.liu2@citrix.com>
---
Cc: Ian Jackson <ian.jackson@eu.citrix.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
---
tools/libxc/xc_dom_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
index 87b450c..b3feb42 100644
--- a/tools/libxc/xc_dom_core.c
+++ b/tools/libxc/xc_dom_core.c
@@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
xc_interface *xch = dom->xch;
uint32_t domid = dom->guest_domid;
unsigned long idx;
- unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
+ unsigned long first_high_idx = (4UL << 30) >> PAGE_SHIFT; /* 4GB */
for ( ; num_pages; num_pages--, extents++ )
{
--
2.1.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] libxc: fix out of range shift in populate_acpi_pages
2016-09-28 15:02 [PATCH] libxc: fix out of range shift in populate_acpi_pages Wei Liu
@ 2016-09-28 15:22 ` Boris Ostrovsky
2016-09-28 15:22 ` Wei Liu
0 siblings, 1 reply; 3+ messages in thread
From: Boris Ostrovsky @ 2016-09-28 15:22 UTC (permalink / raw)
To: Wei Liu, Xen-devel; +Cc: Ian Jackson
On 09/28/2016 11:02 AM, Wei Liu wrote:
> "unsigned int" is only 4-byte long and "4" is treated as int. The shift
> would overflow. Use "unsigned long" (to match the type of idx) and
> "4UL" instead.
>
> Caught by clang compilation test.
>
> Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> ---
> Cc: Ian Jackson <ian.jackson@eu.citrix.com>
> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> ---
> tools/libxc/xc_dom_core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
> index 87b450c..b3feb42 100644
> --- a/tools/libxc/xc_dom_core.c
> +++ b/tools/libxc/xc_dom_core.c
> @@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
> xc_interface *xch = dom->xch;
> uint32_t domid = dom->guest_domid;
> unsigned long idx;
> - unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
> + unsigned long first_high_idx = (4UL << 30) >> PAGE_SHIFT; /* 4GB */
>
> for ( ; num_pages; num_pages--, extents++ )
> {
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] libxc: fix out of range shift in populate_acpi_pages
2016-09-28 15:22 ` Boris Ostrovsky
@ 2016-09-28 15:22 ` Wei Liu
0 siblings, 0 replies; 3+ messages in thread
From: Wei Liu @ 2016-09-28 15:22 UTC (permalink / raw)
To: Boris Ostrovsky; +Cc: Xen-devel, Wei Liu, Ian Jackson
On Wed, Sep 28, 2016 at 11:22:10AM -0400, Boris Ostrovsky wrote:
> On 09/28/2016 11:02 AM, Wei Liu wrote:
> > "unsigned int" is only 4-byte long and "4" is treated as int. The shift
> > would overflow. Use "unsigned long" (to match the type of idx) and
> > "4UL" instead.
> >
> > Caught by clang compilation test.
> >
> > Signed-off-by: Wei Liu <wei.liu2@citrix.com>
>
> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
>
> > ---
> > Cc: Ian Jackson <ian.jackson@eu.citrix.com>
> > Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
> > ---
> > tools/libxc/xc_dom_core.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tools/libxc/xc_dom_core.c b/tools/libxc/xc_dom_core.c
> > index 87b450c..b3feb42 100644
> > --- a/tools/libxc/xc_dom_core.c
> > +++ b/tools/libxc/xc_dom_core.c
> > @@ -1048,7 +1048,7 @@ static int populate_acpi_pages(struct xc_dom_image *dom,
> > xc_interface *xch = dom->xch;
> > uint32_t domid = dom->guest_domid;
> > unsigned long idx;
> > - unsigned int first_high_idx = (4 << 30) >> PAGE_SHIFT; /* 4GB */
> > + unsigned long first_high_idx = (4UL << 30) >> PAGE_SHIFT; /* 4GB */
> >
Actually, Ian pointed out on IRC unsigned long is 32 bit on i386, so
this patch is not enough.
Will try again.
Wei.
> > for ( ; num_pages; num_pages--, extents++ )
> > {
>
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-09-28 15:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-28 15:02 [PATCH] libxc: fix out of range shift in populate_acpi_pages Wei Liu
2016-09-28 15:22 ` Boris Ostrovsky
2016-09-28 15:22 ` Wei Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).